[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Guidelines for Derived Personal Identity Verification (PIV) Credentials:

## Guidelines for Derived Personal Identity Verification (PIV) Credentials

## Guidelines for Derived Personal Identity Verification (PIV) Credentials

This recommendation provides technical guidelines for the implementation of standards-based, secure, reliable, interoperable public key infrastructure (PKI) based identity credentials that are issued by Federal departments and agencies to individuals who possess and prove control over a valid PIV Card. The scope of this document includes requirements for initial issuance and maintenance of these credentials, certificate policies and cryptographic specifications, technical specifications for permitted cryptographic token types and the command interfaces for the removable implementations of such cryptographic tokens.

Guidelines for Derived Personal Identity Verification (PIV) Credentials


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Security Analysis of First Responder Mobile and Wearable Devices:

Wearable devices can also provide situational awareness through the data collected from the sensors, such as an individual's GPS location, heart rate, and other health data. This could be useful when, for instance, monitoring the status of firefighters responding to a fire emergency. If a firefighter's heart rate slows or stops, or if other tracked vital signs indicate a problem, the wearable can send a warning to the fire chief or Incident Commander with that firefighter's status and location. In contrast, wearable devices used by EMS responders can be used on both the emergency medical technician (EMT) and on patients. A vital sign wearable can report blood pressure/blood sugar levels and other vital signs back to the hospital where a doctor can provide real-time assistance to the responder about how to provide proper treatment to a patient.

The Association of Public Safety Communications Officials (APCO) International is an established industry organization of public safety communications professionals from a variety of public safety disciplines, including law enforcement, fire service, and EMS [32]. APCO International assists public safety practitioners by providing professional development, technical assistance, advocacy, training, and outreach services. The organization also runs an online application community known as AppComm-a central repository of mobile apps dedicated to public safety and its use cases [34].

A law enforcement officer needs to identify an individual in a remote area. They use a wearable sensor to capture biometrics to facilitate the identification of the user. The information is transmitted to HQ for processing. The officer receives the results, which provide improved situational awareness and enable an informed action. Depending on coverage, the device may operate in limited offline mode, over 802.11 wireless, LTE, or satellite communications.

Security Analysis of First Responder Mobile and Wearable Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance:

## Revision to Include Updates in Cybersecurity Framework Version 1.1

The Cybersecurity Framework Manufacturing Profile, NISTIR 8183, is scheduled to be revised to include the updates in the Cybersecurity Framework Version 1.1, and will be published as NISTIR 8183, Revision 1.

Once NISTIR, 8183, Revision 1 has been released, this implementation guide will be revised to include the updates in the Cybersecurity Framework Version 1.1 as well, and will be published as NISTIR 8183A, Revision 1.

Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.2 (NIST 3.2.2)?

[Assistant]
According to Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach:

3.2.2   Develop the Cyber Resiliency Baseline ... 3.2.2. 3.2.2   Develop the Cyber Resiliency Baseline

In order to determine whether cyber resiliency improvement is needed, the baseline for the
system (as it is understood at the stage in the life cycle when the cyber resiliency analysis is
performed) must be established.

Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations:

TLS is a protocol created to provide authentication, confidentiality, and data integrity protection between two communicating applications. TLS is based on a precursor protocol called the Secure Sockets Layer Version 3.0 (SSL 3.0) and is considered to be an improvement to SSL 3.0. SSL 3.0 is specified in [32]. The Transport Layer Security version 1 (TLS 1.0) is specified in Request for Comments (RFC) 2246 [23]. Each document specifies a similar protocol that provides security services over the Internet. TLS 1.0 has been revised to version 1.1, as documented in RFC 4346 [24], and TLS 1.1 has been further revised to version 1.2, as documented in RFC 5246 [25]. In addition, some extensions have been defined to mitigate some of the known security vulnerabilities in implementations using TLS versions 1.0, 1.1, and 1.2. TLS 1.3, described in RFC 8446 [57], is a significant update to previous versions that includes protections against security concerns that arose in previous versions of TLS. - More consistent use of authentication, confidentiality, and integrity mechanisms for the protection of information transported across the Internet;
- Consistent use of the recommended cipher suites that encompass NIST-approved algorithms and open standards;
- Protection against known and anticipated attacks on the TLS protocol; and

| Executive Summary..................................................................................................... | Executive Summary..................................................................................................... | Executive Summary.....................................................................................................

Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Proceedings of the Cybersecurity for Direct Digital Manufacturing (DDM) Symposium:

22[12]) -  NIST Framework for Improving Critical Infrastructure Cybersecurity [2] -  NIST IR 8023, Risk Management for Replication Devices [13] -  NIST SP 800-53 Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations [1] -  NIST SP 800-82, Revision 2, Guide to Industrial Control Systems (ICS) Security [14] - [1] NIST Special Publication (SP) 800-53 Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations , Gaithersburg, Maryland, 2013, http://dx.doi.org/10.6028/NIST.SP.800-53r4 - [2] Cybersecurity Framework, National Institute of Standards and Technology, http://www.nist.gov/cyberframework/, 2014 - [3] ISO / ASTM52915 - 13, Standard Specification for Additive Manufacturing File Format (AMF) Version 1.1 , Astm, 2013, http://www.astm.org/Standards/ISOASTM52915.htm - [4] IEC 62264-1:2013, Enterprise-control system integration -- Part 1: Models and terminology , International Organization for Standardization, 2013, http://www.iso.org/iso/catalogue\_detail.htm?csnumber=57308 - [5] ISA-95, Enterprise-Control System Integration , International Society of Automation, https://www.isa.org/isa95/ - [6] ISO 10303-242:2014, Industrial automation systems and integration -- Product data representation and exchange -- Part 242: Application protocol: Managed model-based 3D engineering , International Organization for Standardization, 2014, http://www.iso.org/iso/iso\_catalogue/catalogue\_tc/catalogue\_detail.htm?csnumber=5762 0 - [7] ISO 14306:2012, Industrial automation systems and integration -- JT file format specification for 3D visualization , International Organization for Standardization,2012, http://www.iso.org/iso/catalogue\_detail.htm?csnumber=60572 -

Proceedings of the Cybersecurity for Direct Digital Manufacturing (DDM) Symposium


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to IoT Device Cybersecurity Guidance for the Federal Government_ IoT Device Cybersecurity Requirement Catalog:

| 62 | |------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------| | (CSC) Cybersecurity Capabilities..................................................................62 | | | (EOL) End-of-Life (Reprovisioning and Disposal) .........................................64 | | | (RSP) Cybersecurity Responsibilities............................................................64 | | | (EXP) Cybersecurity Expectations and Assumptions....................................65 | | | (BAK) Data Back-up......................................................................................66 | | | (VMG) Vulnerability Management Options....................................................67 | | | References...................................................................................................................69 | | | List of Appendices | List of Appendices | | Definition of the Federal Profile for IoT Device Cybersecurity Requirements ..............................................................................................................71 | | | Mapping of SP 800-53 Controls to Device Cybersecurity Requirements ..............................................................................................................75 | | | Mapping of Cybersecurity Framework Outcomes to Device Cybersecurity Requirements .....................................................................................83 | | | Acronyms............................................................................................91 Glossary...............................................................................................92 | |

IoT Device Cybersecurity Guidance for the Federal Government_ IoT Device Cybersecurity Requirement Catalog


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Cybersecurity Framework Profile for Liquefied Natural Gas:

| Category........................................................................................................................................23 |
| Table 22.
CSF Subcategory Priorities for the Identify Function's Business Environment (ID.BE) Category........................................................................................................................................23        |                                                                                |
| Table 23. CSF Subcategory Priorities for the Identify Function's Governance (ID.GV) Category. .......................................................................................................................................................24 |                                                                                |
| Table 24. CSF Subcategory Priorities for the Identify Function's Risk Assessment (ID.RA) Category........................................................................................................................................24             |                                                                                |
| Table 25. CSF Subcategory Priorities for the Identify Function's Risk Management Strategy (ID.RM)                                                                                | Category..........................................................................................................................25               |
| Table 26. CSF Subcategory Priorities for the Identify Function's Supply Chain Management (ID.SC) Category.

Cybersecurity Framework Profile for Liquefied Natural Gas


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Guide for Developing Security Plans for Federal Information Systems:

ification of compensating controls; and (iii) the specification of agency-defined parameters in the security controls, where allowed. The system security plan should document all tailoring activities.
- -Security controls that uniquely support the confidentiality, integrity, or availability security objectives can be downgraded to the corresponding control in a lower baseline (or appropriately modified or eliminated if not defined in a lower baseline) if, and only if, the downgrading action: (i) is consistent with the FIPS 199 security categorization for the corresponding security objectives of confidentiality, integrity, or availability before moving to the high watermark; 14 (ii) is supported by an agency's assessment of risk; and (iii) does not affect the security-relevant information within the information system. 15

Guide for Developing Security Plans for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to NIST Cloud Computing Forensic Science Challenges:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications.  Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST.

NIST Cloud Computing Forensic Science Challenges


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to PIV Card Application and Middleware Interface Test Guidelines (SP 800-73-4 Compliance):

3.2.1 PIV Card Application Card Command Interface Tests ... 3.2.1 PIV Card Application Card Command Interface Tests ... 3.2.1 PIV Card Application Card Command Interface Tests ...

PIV Card Application and Middleware Interface Test Guidelines (SP 800-73-4 Compliance)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Guide for Conducting Risk Assessments:

nimum organization-wide security controls; (vi) conformance to enterprise/security architectures; and (vii) monitoring strategies and ongoing authorizations of information systems and common controls.
At Tier 2, risk assessments can affect, for example: (i) enterprise architecture/security architecture design decisions; (ii) the selection of common controls; (iii) the selection of suppliers, services, and contractors to support organizational missions/business functions; (iv) the development of risk-aware mission/business processes; and (v) the interpretation of information security policies with respect to organizational information systems and environments in which those systems operate. Finally, at Tier 3, risk assessments can affect, for example: (i) design decisions (including the selection, tailoring, and supplementation of security controls and the selection of information technology products for organizational information systems); (ii) implementation decisions (including whether specific information technology products or product configurations meet security control requirements); and (iii) operational decisions (including the requisite level of monitoring activity, the frequency of ongoing information system authorizations, and system maintenance decisions).


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Risk Management for Replication Devices provide? (Part 5)

[Assistant]
...............................................11  |
| Appendix A - References..........................................................................................................................
A-1            |
| Appendix B - Sample Security Risk Assessment....................................................................................B-1                              |
| Security Risk Assessment Table for Replication Devices (RDs) .............................................................B-2                                    |
| Security Risk Assessment Flow Chart for Replication Devices (RDs)....................................................B-7                                         |
| Total Risk Scores and Risk Levels ........................................................................................................B-11                   |
| Appendix C: Roles and Responsibilities ................................................................................................. C-1                     |

## 1. Introduction

A replication device (RD) is any device that reproduces (e.g., copies, prints, scans) documents, images, or objects from an electronic or physical source. For the purposes of this NISTIR, RDs include copiers, printers, three-dimensional (3D) printers, scanners, 3D scanners, as well as multifunction machines when used as a copier, printer, or scanner. RDs in use within organizations run the gamut in terms of age and functionality. Older, single-function devices may have no internal, nonvolatile storage and cannot be networked. Other devices may provide a variety of functions, be network-connected, run commercially available operating systems, contain internal, nonvolatile storage, and contain embedded internal print servers and web server capability. In between the two extremes, there may be RDs with network and/or storage functionality but no discernable means to configure them securely.

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be  used  by  Federal  agencies  even  before  the  completion  of  such  companion  publications.  Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  Federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST.

-  Lack of Physical Security Controls. Telework client devices are used in a variety of locations outside the organization's control, such as users' homes, coffee shops, hotels, and conferences. The mobile nature of these devices makes them more likely to be lost or stolen, which places the data on the devices at increased risk of compromise. When planning telework security policies and controls, organizations should assume that client devices will be acquired by malicious parties who will either attempt to recover sensitive data from the devices or leverage the devices to gain access to the enterprise network.

Additional information on the four categories of remote access methods is provided below. When planning a remote access solution, organizations should carefully consider the security implications of the remote access methods in each category, in addition to how well each method may meet operational requirements.

Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Guide for Security-Focused Configuration Management of Information Systems:

| senior information security officer           | See Senior Agency Information Security Officer. |
|-----------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| spyware [CNSSI-4009]                          | Software that is secretly or surreptitiously installed into an information system to gather information on individuals or organizations without their knowledge; a type of malicious code. |
| system [CNSSI 4009]                           | Any organized assembly of resources and procedures united and regulated by interaction or interdependence to accomplish a set of specific functions. Note: Systems also include specialized systems such as industrial/process controls systems, telephone switching and private branch exchange (PBX) systems, and environmental control systems. |
| system administrator [SP 800-37]              | An individual, group, or organization responsible for setting up and maintaining a system or specific system elements, implements approved secure baseline configurations, incorporates secure configuration settings for IT products, and conducts/assists with configuration monitoring activities as needed. |
| system component                              | A discrete identifiable information technology asset that represents a building block of a system and may include hardware, software, and firmware. |
| system owner (or program manager) [SP 800-37] | An organizational official responsible for the procurement, development, integration, modification, operation, maintenance, and disposal of a system.

Guide for Security-Focused Configuration Management of Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.3 (NIST 3.1.3)?

[Assistant]
According to Hardware-Enabled Security_ Enabling a Layered Approach to Platform Security for Cloud and Edge Computing Use Cases:

3.1.3). 3.1.3 Arm Realm Memory Isolation and Protection

As shown in Figure 11, TrustZone provides two security states each associated with its own PAS: the Secure PAS and the Non-secure PAS.

Hardware-Enabled Security_ Enabling a Layered Approach to Platform Security for Cloud and Edge Computing Use Cases


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Program Review for Information Security Management Assistance (PRISMA):

Introduction .........................................................................................................................1 | |----------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------| | | 1.1 | Purpose.......................................................................................................................1 | | | | 1.2 | Legislative Background...............................................................................................2 | | | | 1.3 | PRISMA......................................................................................................................2 | | | | 1.4 | PRISMA Assumptions and Constraints ......................................................................3 | | | | 1.5 | Audience.....................................................................................................................4 | | | | 1.6 | Document Organization | ..............................................................................................4 | | 2.

Program Review for Information Security Management Assistance (PRISMA)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Security and Trust Considerations for Digital Twin Technology:

operators to form models and visual representations of oil rigs, drill rigs, and drill bit heads deep in the ocean. - Robotic surgery: There are surgical robots that perform various kinds of surgery.
Some require an actual human surgeon to control the robot, while others only require a human surgeon to monitor the robot's automatic execution of the surgery. Digital twin technology could be used in pre-surgery planning and to foster surgical tool interoperability. For example, one company's surgical robot could interoperate with another company's VR system that specializes in the representation of human organs.

Security and Trust Considerations for Digital Twin Technology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Physical Protection?

[Assistant]
According to A Methodology for Enabling Forensic Analysis Using Hypervisor Vulnerabilities Data:

zation is a key technology in cloud computing environments that enables ubiquitous access to shared pools of system resources and high-level services provisioned with minimal management effort [1, 2].
An Operating System (OS) directly controls hardware resources in a non-virtualized system, but virtualization,  typically  performed  by  a  hypervisor  (also  called  a  virtual  machine  monitor  or VMM) [3] within a cloud environment, provides a mechanism that abstracts the hardware and system resources from an OS. As a software layer that lies between the physical hardware and the Virtual  Machines  (VMs  or  guest  machines),  a  hypervisor  supports  the  guest  machines  by presenting the guest OSs with a virtual operating platform and managing their execution.

A Methodology for Enabling Forensic Analysis Using Hypervisor Vulnerabilities Data


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Case Studies in Cyber Supply Chain Risk Management_ Palo Alto Networks, Inc.:

| Company Overview.................................................................................................................2         |
|--------------------------------------------------------------------------------------------------------------------------------------------|
| Risk Profile ..........................................................................................................................2   |
| Highlighted Practices in Cyber Supply Chain Management ..................................................2                                 |
| Organizational Approach to Supply Chain Risk and Cybersecurity............................................3                                |
| Supplier Management.............................................................................................................4          |
| Key Aspects of Managing Supplier Relationships .................................................................4                          |
| Measuring Supplier Risk ......................................................................................................5            |
| Quality Management and Continuous Improvement...........................................................5                                  |
| Incident Response and Recovery .........................................................................................6                  |
| Lessons Learned and Improvement Opportunities ..................................................................7                          |
| References ..............................................................................................................................8 |

## Incident Response and Recovery

Confirmed incidents trigger the formal incident response plan (IRP).

Case Studies in Cyber Supply Chain Risk Management_ Palo Alto Networks, Inc.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Computer Security Division 2008 Annual Report:

| Computer Security Division Publications - FY 2008 | 53 55 | | Ways to Engage Our Division and NIST | | | Acknowledgements | 56 |

Computer Security Division 2008 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IR.L2-3.6.1 (NIST 3.6.1)?

[Assistant]
According to Enterprise Impact of Information and Communications Technology Risk_ Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio:

3.6.1. 3.6.1.

Enterprise Impact of Information and Communications Technology Risk_ Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Communications Protection?

[Assistant]
According to Security Requirements for Cryptographic Modules:

CATEGORY: INFORMATION SECURITY     SUBCATEGORY: CRYPTOGRAPHY

Key words : computer security; telecommunication security; physical security; software security; cryptography; cryptographic modules; Federal Information Processing Standard (FIPS); ISO/IEC 19790; ISO/IEC 24759.

1. Name of Standard. Security Requirements for Cryptographic Modules (FIPS PUB 140-3).
2. Category of Standard. Computer Security Standard, Cryptography.
3. Explanation. This  standard  specifies  the  security  requirements  that  will  be  satisfied  by  a cryptographic  module  utilized  within  a  security  system  protecting  sensitive  but  unclassified information (hereafter referred to as sensitive information).  The standard provides four increasing, qualitative levels of security: Level 1, Level 2, Level 3, and Level 4.  These levels are intended to cover the wide range of potential applications and environments in which cryptographic modules may  be  employed.    The  security  requirements  cover  areas  related  to  the  secure  design  and implementation  of  a cryptographic module. These  areas  include  cryptographic  module specification; cryptographic module interfaces; roles, services, and authentication; software/firmware  security;  operating  environment;  physical  security;  non-invasive  security; sensitive security parameter management; self-tests; life-cycle assurance; and mitigation of other attacks.  This standard supersedes FIPS 140-2, Security Requirements for Cryptographic Modules , in its entirety.

Security Requirements for Cryptographic Modules


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture:

ntific data formatting library with only seven dependencies, while Data Mining Classification and Regression Methods (rminer) [21] - an R-based data mining application - has 150 software dependencies.
The full software stack can be split into three general categories that differ based on the maintainer: user software, facility software, and vendor software.

High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to 2019 NIST_ITL Cybersecurity Program Annual Report:

The NCCoE launched a project to demonstrate an approach for improving enterprise patching practices for general IT systems. In this project, commercial and open-source tools will be used to address the most challenging aspects of patching, including system characterization and prioritization, patch testing, and patch implementation tracking and verification. These tools are accompanied by actionable, prescriptive guidance on establishing policies and processes for the entire patching life cycle. For example, roles and responsibilities are defined for all affected personnel, and a playbook is established with rapid mitigation actions for destructive malware outbreaks that organizations can tactically execute in the first 30 days as well as recommendations that can be implemented strategically beyond 30 days. This project has resulted in

- Guest Research Internships opportunities at ITL for 6- to 24-month terms. Qualified individuals should contact ITL (itl\_inquiries@nist.gov) to provide qualifications and indicate the area of work that is of interest. - The NIST Pathways Program offers paths to federal internships for students from high school through post-graduate school as well as careers for recent graduates. It provides training and career development opportunities for individuals who are at the beginning of their federal service. For further details on Pathways and other student programs at NIST, please see https:/ /www.nist.gov/ohrm/staffing/ students.cfm. - The ITL Summer Undergraduate Research Fellowship (SURF) Program is designed to provide hands-on research experience in applied mathematics, statistics, computer security, information access, software testing, and networking technologies. See https:/ /www.nist.gov/itl/how-work-us/itl-surf-program. - Opportunities for a temporary assignment of government or military personnel for 6- to 24-month details in ITL.

2019 NIST_ITL Cybersecurity Program Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to PBX Administrator’s Security Standards:

ons                                            | A-1    |

- Become knowledgeable about PBX and all adjurKt system capabilities. - Monitor all PBX and adjunct system options and settings periodically.
- Set all passwords to conform to FDIC requirements. - Ensure that telephone bills and call detail reports are reviewed for fraud and abuse. - Educate fellow employees about how to avoid PBX fraud. - Determine appropriate time of day/day of week access restrictions. - Shred and dispose of old PBX manuals. - Protect corporate telephone books and directories from unauthorized access. - Know the symptoms of PBX and voice mail fraud. - Protect your voice mail system from unauthorized access. - Restrict DID and outward calling access to stations with an operational requirement. - Prohibit the use of Direct Inward System Access (DISA). - Restrict call transfer capability to within the PBX for automated attendant systems. - Enforce monthly change of PBX and adjunct system administration passwords. - Block country code access where FDIC operations do not take place. - Limit telephone service to that required by the station. - Protect modem pools by using COS/COR restrictions. - Restrict direct access to trunks and trunk groups. - Restrict the ability of incoming calls to access outgoing trunks. - Use FDIC's networking services to maximize calling efficiertcy and to minimize abuse. - Ensure that PBX, adjunct system equipment, and wire closets are physically secure. - Apply physical security measures to shared building or telephone facilities. - Apply PBX security measures to key telephone systems, to the extent possible. - Maintain up-to-date, complete configuration management records. - Maintain copies of all contractual agreements for PBXs and PBX services. - Ensure that end users are aware of their telephone system security responsibilities. - Report all PBX related security incidents to the VNSU and ASU.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Report on the Design-A-Thon_ Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness provide?

[Assistant]
<!-- image -->

## NIST Internal Report NIST IR 8558

## Report on the Design-A-Thon: Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness

Michael Fagan Julie Haney Daniel Eliot Barbara Cuthill Kristina Rigopoulos

This publication is available free of charge from:

https://doi.org/10.6028/NIST.IR.8558

<!-- image -->

## NIST Internal Report NIST IR 8558

## Report on the Design-A-Thon: Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness

Michael Fagan Daniel Eliot Barbara Cuthill Kristina Rigopoulos

Applied Cybersecurity Division Information Technology Laboratory

Julie Haney Information Access Division Information Technology Laboratory

This publication is available free of charge from:

https://doi.org/10.6028/NIST.IR.8558

September 2025

<!-- image -->

U.S. Department of Commerce Howard Lutnick, Secretary

Certain equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

Report on the Design-A-Thon_ Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Service Mesh Proxy Models for Cloud-Native Applications:

| October 2024                                                                                | October 2024                                                                                | Cloud-Native Applications   |
|-------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------|
| 5.2.7. | Denial of Service (TR-7)...........................................................................................................19           |                             |
| 5.2.8.

Service Mesh Proxy Models for Cloud-Native Applications


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Security Property Verification by Transition Model:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems.

Security Property Verification by Transition Model


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Guide to Integrating Forensic Techniques into Incident Response:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the nationGLYPH<146>s measurement and standards infrastructure.  ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology.  ITLGLYPH<146>s responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems.  This Special Publication 800-series reports on ITLGLYPH<146>s research, guidance, and outreach efforts in computer security and its collaborative activities with industry, government, and academic organizations.

This section discusses several aspects of organizing a forensics capability for an organization.  It begins by showing the wide variety of potential uses for forensics, and then presents a high-level overview of the forensics process.  The next part of the section discusses how forensics services are typically provided and provides guidance on building and maintaining the necessary skills to perform forensics tasks.  The section also explains the need to include various teams from throughout the organization, such as legal advisors and physical security staff, in some forensic activities.  The section ends by discussing how policies, guidelines, and procedures should address forensics (e.g., defining roles and responsibilities, providing guidance on the proper usage of tools and techniques, incorporating forensics into the information system life cycle).

- ! Operational Troubleshooting. Many forensic tools and techniques can be applied to troubleshooting operational issues, such as finding the virtual and physical location of a host with

Guide to Integrating Forensic Techniques into Incident Response


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Guide for Developing Security Plans for Federal Information Systems:

2 OMB Circular A-130, Appendix III, defines general support system as an interconnected set of information resources under the same direct management control that shares common functionality. It normally includes hardware, software, information, data, applications, communications, and people. system to the high watermark or highest impact level must be applied when grouping minor applications/subsystems with varying FIPS 199 impact levels into a single general support system or major application unless there is adequate boundary protection, e.g., firewalls and encryption, around those subsystems or applications with the highest impact level. Additionally, there must be assurance that the shared resources, i.e., networks, communications, and physical access within the whole general support system or major application, are protected adequately for the highest impact level. Having the ability to isolate the high impact systems will not only result in more secure systems, but will also reduce the amount of resources required to secure many applications/systems that do not require that level of security. NIST SP 800-53 provides three security control baselines, i.e., low, moderate, and high, that are associated with the three FIPS 199 impact levels; as the impact level increases, so do the minimum assurance requirements. For reporting purposes, i.e., FISMA annual report, when an information system has varying FIPS 199 impact levels, that system is categorized at the highest impact level on that information system. Major applications are systems that perform clearly defined functions for which there are readily identifiable security considerations and needs (e.g., an electronic funds transfer system). A major application might comprise many individual programs and hardware, software, and telecommunications components. These components can be a single software application or a combination of hardware/software focused on supporting a specific, mission-related function.

Guide for Developing Security Plans for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Cybersecurity of Genomic Data:

| Potential Privacy Problems........................................................................................9                 |                                                                                |
| 3.3. | Discrimination and Reputational Concerns..............................................................10                            |                                                                                |
| 3.4. | Economic Concerns.................................................................................................11                |                                                                                |
| 3.5. | Health Outcome Concerns ......................................................................................11                    |                                                                                |
| 3.6. | Other Potential Future Concerns.............................................................................11                      |                                                                                |
| 3.7.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does 2020 Cybersecurity and Privacy Annual Report provide? (Part 3)

[Assistant]
in the role of the Red Queen in Lewis Carroll's 'Through the Looking-Glass.' In that classic, the Queen tells Alice: "Now, here, you see, it takes all the running you can do to keep in the same place.
If you want to get somewhere else, you must run at least twice as fast as that!"

It  is  true  that  leaders  need  to  be  nimble  and  move  quickly  to  avoid  the consequences of cybersecurity and privacy attacks that threaten their  enterprises. That  need  extends  to  government  agencies,  like  NIST, that are  trying  to  help  meet  those urgent challenges. At NIST, we know that - in addition to current needs - we also have a responsibility to keep an eye on the horizon, anticipating technology changes, threat environments, and cultural shifts that could affect the ability of organizations to manage cybersecurity and privacy risks. We've  successfully  carried  out  our  work  for  nearly  50  years  precisely  because  we  not  only address near-term challenges but also spend time thinking, exploring, listening, and speaking with others about the really big issues in store for all of us. We tackle current issues, but we also  play  the  long game  -  the  infinite game,  if  you  will. We  are  mindful  of  the  reality  that cybersecurity and privacy challenges are evolving. At NIST, we make it our business to help others be prepared by anticipating needs and creating opportunities. We anchor our decisions with our feet firmly planted in both the present and the future. As you read this report about our efforts and accomplishments in 2020, you will understand how we have been addressing both short-term and long-term needs.

2020 Cybersecurity and Privacy Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.4 (NIST 3.5.4)?

[Assistant]
According to Contingency Planning Guide for Federal Information Systems:

3.5.4 TT&E                                                                                | Exercises... 3.5.4 provides guidance on the type of TT&E identified for each FIPS 199 impact level. 3.5.4 TT&E Program Summary

A TT&E program provides an overall framework for determining, scheduling, and setting objectives for TT&E activities.

Contingency Planning Guide for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Security Considerations for Voice Over IP Systems:

- difficulties, particularly in key management. Here, access control mechanisms and policy enforcement may help. -  A mechanism to allow VOIP traffic through firewalls is required. There are a variety of protocol dependent and independent solutions, including application level gateways (ALGs) for VOIP protocols, Session Border Controllers, or other standards-based solutions when they mature. -  Stateful packet filters can track the state of connections, denying packets that are not part of a properly originated call. (This may not be practical when multimedia protocol inherent security or lower layer security is applied, e.g., H.235 Annex D for integrity provision or TLS to protect SIP signaling.)
-  Use IPsec or Secure Shell (SSH) for all remote management and auditing access. If practical, avoid using remote management at all and do IP PBX access from a physically secure system. - If performance is a problem, use encryption at the router or other gateway, not the individual endpoints, to provide for IPsec tunneling. Since some VOIP endpoints are not computationally powerful enough to perform encryption, placing this burden at a central point ensures all VOIP traffic emanating from the enterprise network has been encrypted. Newer IP phones are able to provide Advanced Encryption System (AES) encryption at reasonable cost. Note that Federal Information Processing Standard (FIPS) 140-2, Security Requirements for Cryptographic Modules, is applicable to all Federal agencies that use cryptographic-based security systems to protect sensitive information in computer and telecommunication systems (including voice systems) as defined in Section 5131 of the Information Technology Management Reform Act of 1996, Public Law 104-106. 2. Ensure that the organization has examined and can acceptably manage and mitigate the risks to their information, system operations, and continuity of essential operations when deploying VOIP systems.

Security Considerations for Voice Over IP Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Guide to Secure Web Services:

| Executive Summary..............................................................................................................ES-1 | Executive Summary..............................................................................................................ES-1 | Executive Summary..............................................................................................................ES-1 | Executive Summary..............................................................................................................ES-1 | |---------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------| | Introduction | | ......................................................................................................................1-1 | | | 1.1 | Authority...................................................................................................................1-1 | Authority...................................................................................................................1-1 | | | 1.2 | Purpose and Scope .................................................................................................1-1 | Purpose and Scope .................................................................................................1-1 | | | 1.3 | Audience..................................................................................................................1-1 | Audience..................................................................................................................1-1 | | | 1.4 | Document Structure.................................................................................................1-2 | Document Structure.................................................................................................1-2 | | | 2.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What are the CMMC Level 1 requirements?

[Assistant]
According to Workshop Summary Report for “Cybersecurity Risks in Consumer Home Internet of Things (IoT) Products” Virtual Workshop:

ory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications.
Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## Comments on this publication may be submitted to:

National Institute of Standards and Technology Attn: Applied Cybersecurity Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

Email: iotsecurity@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA). ## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. ## Abstract

This report provides a summary of the discussion and findings from the NIST Cybersecurity Risks in Consumer Home Internet of Things (IoT) Devices virtual workshop in October 2020.

Workshop Summary Report for “Cybersecurity Risks in Consumer Home Internet of Things (IoT) Products” Virtual Workshop


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does PBX Administrator’s Security Standards provide?

[Assistant]
I

<!-- image -->

I

## PBX Administrator's Security Standards

## Deveioped by the Federai Deposit insurance Corporation

NISTIR 4816

## Edward Roback NIST Coordinator

U.S. DEPARTMENT OF COMMERCE Technology Administration National Institute of Standards and Technology Gaithersburg, MD 20899

<!-- image -->

## PBX Administrator's Security Standards

## Deveioped by the Federai Deposit insurance Corporsition

## Edward Roback NIST Coordinator

U.S. DEPARTMENT OF COMMERCE Technology Administration National Institute of Standards and Technology Gaithersburg, MD 20899

April 1992

<!-- image -->

U.S. DEPARTMENT OF COMMERCE Barbara Hackman Franklin, Secretary

TECHNOLOGY ADMINISTRATION Robert M. White, Under Secretary for Technology

NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY John W. Lyons, Director

•%)<'<5tWtaR's'f

'M

^c. ^.^i4i<^^'l w J'f'fi'

riV»lT^S5^

^0

## Preface

This National Institute of Standards and Technology Interagency Report (NISTIR) presents the Federal Deposit Insurance Corporation's (FDIC) PBX Administrator's Security Standards . It was developed to provide a generic set of security standards to phone system administrators and users throughout FDIC. The document discusses telephone policy, PBX fraud, PBX administration and anticipated future concerns. The duties and responsibilities for PBX system administrators may prove to be of particular interest to federal departments and agencies. The National Institute of Standards and Technology (NIST) makes no claim or endorsement of these standards. However, as this material may be of use to other organizations, it is being reprinted by NIST to provide for broad public dissemination of this federally sponsored work. This publication is part of a continuing effort to assist federal agencies in accordance with NIST's mandate under the Computer Security Act of 1987. NIST expresses its appreciation to FDIC for their kind permission to publish this report.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Security Architecture Design Process for Health Information Exchanges (HIEs):

ining, human resources issues, or nontechnical privacy issues, it does describe an architecture design process that allows for their integration into the information technology architecture of an HIE.
| Capstone Policy Drivers                                                                                | Entities Affected                                                                                | Enabling Services Affected                                                                                | Comment                                                                                |
|-----------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Federal Regulations: Electronic Records; Electronic Signatures; Electronic Submissions; Establishment of Public Docket; Notice 28 CFR Part 11 | Research facilities that transmit information to the Food and Drug Administration                                                                                | Entity Identity Assertion (Authentication).

Security Architecture Design Process for Health Information Exchanges (HIEs)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guidelines for Smart Grid Cybersecurity provide? (Part 5)

[Assistant]
...................................................... 4
1.2  Scope and Definitions ....................................................................................................................
5
1.3  Smart Grid Cybersecurity Document Development Strategy ........................................................ 6
1.4  Combined Cyber-Physical Attacks .............................................................................................. 12
 CHAPTER 2   LOGICAL ARCHITECTURE AND INTERFACES OF THE SMART GRID ......................14
2.1  The Seven Domains to the Logical Reference Model ................................................................. 15
2.2  Logical Security Architecture Overview ..................................................................................... 24
2.3  Logical Interface Categories ........................................................................................................ 28
 CHAPTER 3  HIGH-LEVEL SECURITY REQUIREMENTS ...............................................................75
3.1  Cybersecurity Objectives ............................................................................................................. 75
3.2  Confidentiality, Integrity, and Availability Impact Levels .......................................................... 76
Impact Levels for the CI&A Categories ...................................................................................... 77
3.3
3.4  Selection of Security Requirements ............................................................................................. 79
3.5  Security Requirements Example .................................................................................................. 80
3.6  Recommended Security Requirements ........................................................................................ 81
3.7  Access Control (SG.AC) .............................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Case Studies in Cyber Supply Chain Risk Management_ Palo Alto Networks, Inc.:

Security and data protection are inseparable from Palo Alto Networks' role as a cybersecurity product provider. Thousands of companies and governments around the world rely on these products to protect highly sensitive information. For Palo Alto Networks, cybersecurity and product integrity are an implicit corporate mandate. Given Palo Alto Networks' role as a cybersecurity vendor, the company is subject to intense scrutiny from potential customers and is a target for a variety of threat actors. Recognizing that a product security incident could have an enormous impact on customers, Palo Alto Networks considers cybersecurity and product integrity an implicit corporate mandate. All products are subject to the company's end-to-end product security framework (E2E Framework). The framework is designed to provide defense in depth for each stage of the product lifecycledesign, sourcing, manufacturing, fulfilment, and service. Each stage is independently evaluated to determine security risks, and domain experts select relevant public standards and best practices to target those risks. Selected standards include the Federal Information Processing Standards (FIPS) i , Common Criteria ii , and the United Kingdom's Commercial Product Assurance (CPA) iii . Palo Alto Networks provides functional testing infrastructure for all products to the CM. These platforms are designed in-house and perform software diagnostics to ensure product integrity. While the tests are performed by the CM, the testing infrastructure remains under Palo Alto Networks' control. Tested products are outfitted with tamper-evident packaging and shipping labels featuring unique product identifiers, such as part and serial numbers, to ensure that the products received by the customer were not compromised in transit.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Minimum Security Requirements for Federal Information and Information Systems provide? (Part 5)

[Assistant]
extended to reflect: (i) the experience gained from using the controls; (ii) the changing security requirements within federal agencies; and (iii) the new security technologies that may be available.
The minimum security controls defined in the low, moderate, and high security control baselines are also expected to change over time as well, as the level of security and due diligence for mitigating risks within federal agencies increases. The proposed additions, deletions, or modifications to the catalog of security controls and the proposed changes to the security control baselines in NIST Special Publication 800-53 will go through a rigorous, public review process to obtain government and private sector feedback and to build consensus for the changes. Federal agencies will have up to one year from the date of final publication to fully comply with the changes but are encouraged to initiate compliance activities immediately. ## 11. Waivers. No provision is provided under FISMA for waivers to FIPS made mandatory by the Secretary of Commerce. ## 12. Where to Obtain Copies. This publication is available from the NIST Computer Security Division web site by accessing http://csrc.nist.gov/publications.

Minimum Security Requirements for Federal Information and Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Guide to a Secure Enterprise Network Landscape:

tection and response (EDR) solutions that collect security telemetry data on endpoints. Any threat that is already inside of a network can move laterally and remain undetected for days or even months.
- Edge computing [1], where much of the computing takes place close to the location of multiple IoT devices that may be geographically dispersed
- Users located both within and outside of the corporate network, such as in homes, remote branch offices, and public locations (e.g., hotels, pubs); some enterprises must also provide access to ecosystem partners, who may be on their own corporate networks

Guide to a Secure Enterprise Network Landscape


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to The NIST Cybersecurity Framework (CSF) 2.0:

- Roles, Responsibilities, and Authorities (GV.RR): Cybersecurity roles, responsibilities, and authorities to foster accountability, performance assessment, and continuous improvement are established and communicated - o GV.RR-01: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving - o GV.RR-02: Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced - o GV.RR-03: Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies - o GV.RR-04: Cybersecurity is included in human resources practices - Policy (GV.PO): Organizational cybersecurity policy is established, communicated, and enforced - o GV.PO-01: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced - o GV.PO-02: Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission - Oversight (GV.OV): Results of organization-wide cybersecurity risk management activities and performance are used to inform, improve, and adjust the risk management strategy - o GV.OV-01: Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction - o GV.OV-02: The cybersecurity risk management strategy is reviewed and

The NIST Cybersecurity Framework (CSF) 2.0


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IR.L2-3.6.4 (NIST 3.6.4)?

[Assistant]
According to Module-Lattice-Based Digital Signature Standard:

3.6.4                                                                  | No Floating-Point Arithmetic . 3.6.4 No Floating-Point Arithmetic

Implementations of ML-DSA shall not use floating-point arithmetic, as rounding errors in floating point operations may lead to incorrect results in some cases.

Module-Lattice-Based Digital Signature Standard


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Risk Management for Replication Devices:

-  Unencrypted information: Unencrypted information is subject to unauthorized exposure and modification. Any information, including configuration data or passwords, sent unencrypted to a RD could be intercepted, exposed, and/or altered. -  Open ports/protocols: Open ports and protocols allow data to flow to and from a device. When unused ports/protocols are not disabled, attackers may be able to access a machine undetected. Repudiation issues (e.g., removing origination information from file metadata, deleting entries from usage logs), data tampering, exposure of management consoles, network bouncing (hiding the source of a user's network connection), information disclosure, or denial of service are some of the associated potential security incidents. -  Denial of service (DoS): RDs connected to the Internet may be more vulnerable to this threat which results in devices being temporarily unusable. -  Wireless connectivity: Wireless functionality allows communications via Bluetooth or 802.11 to other devices or with the Internet. As with wired RDs, if not encrypted, these communications may potentially be intercepted. -  Access permissions: Anyone with the necessary equipment and access can potentially compromise a RD. Some RDs allow remote access for automatic updates, configuration changes, or maintenance. If access is not controlled or automatic downloads verified, this capability could be used to install malware or rootkits, gain access to other areas of the network, compromise configuration settings including passwords, disable a device, or expose stored information.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.3 (NIST 3.3.3)?

[Assistant]
According to Interfaces for Personal Identity Verification_ Part 1 – PIV Card Application Namespace, Data Model and Representation:

3.3.3. 3.3.3.

Interfaces for Personal Identity Verification_ Part 1 – PIV Card Application Namespace, Data Model and Representation


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Protocol Implementation Conformance Statement (PICS) Proforma for the SDNS Security Protocol at Layer 4 (SP4):

- (1) Data Integrity,
- (2) Data Confidentiality,
- (3) Data Origination Authentication, and
- (4) Access Control.

| Index       | Service Element                          | Status   | Support   | Support   |
|-------------|------------------------------------------|----------|-----------|-----------|
| TOSEO       | Confidentiality                          | 0.1      | Y         | N         |
| TOSEl       | Connection Confidentiality               | TOSEO:m  | Y         | N         |
| T0SE2 T0SE3 | Connectionless Confidentiality Integrity | - 0.1    | Y         | N         |
| T0SE4       | Connection Integrity w Recovery          | -        |           |           |
| T0SE5       | Connection Integrity wo Recovery         | -        |           |           |
| T0SE6       | Connectionless Integrity                 | T0SE3:m  | Y         | N         |
| T0SE7       | Data Origination Authentication          | m        | Y         | N         |
| T0SE8       | Access Control                           | o        | Y         | N         |

| Index   | Service Element                  | Status    | Support   | Support   |
|---------|----------------------------------|-----------|-----------|-----------|
| T3SE0   | Confidentiality                  | 0.1       | Y         | N         |
| T3SE1   | Connection Confidentiality       | T3SE0;m   | Y         | N         |
| T3SE2   | Connectionless Confidentiality   | -         |           |           |
| T3SE3   | Integrity                        | 0.1       | Y         | N         |
| T3SE4   | Connection Integrity w Recovery  | -         |           |           |
| T3SE5   | Connection Integrity wo Recovery | T3SE3:o.2 | Y         | N         |
| T3SE6   | Connectionless Integrity         | T3SE3:o.2 | Y         | N         |
| T3SE7   | Data Origination Authentication  | m         | Y         | N         |
| T3SE8   | Access Control                   | 0         | Y         | N         |

Protocol Implementation Conformance Statement (PICS) Proforma for the SDNS Security Protocol at Layer 4 (SP4)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Measurement Guide for Information Security_ Volume 1 — Identifying and Selecting Measures:

Measurement provides data that can enable an organization to examine the impacts of implementing information security programs, specific controls, and associated policies and procedures. Such data is integral when making risk-based decisions, weighing performance against designated metrics, and demonstrating compliance. Measurement can also increase accountability and strengthen governance by providing data that can facilitating the identification of the personnel responsible for controls implemented within specific organizational components or systems and support an environment that allows for continuous analysis and improvement.

Measurement Guide for Information Security_ Volume 1 — Identifying and Selecting Measures


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI):

## Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI)

## Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI)

The purpose of this Special Publication is to provide appropriate and useful guidelines for assessing the reliability of issuers of Personal Identity Verification (PIV) Cards and Derived PIV Credentials. These issuers store personal information and issue credentials based on Office of Management and Budget (OMB) policies and on the standards published in response to Homeland Security Presidential Directive 12 (HSPD-12) and therefore are the primary target of the assessment and authorization under this guideline. The reliability of an issuer is of utmost importance when one organization (e.g., a federal agency) is required to trust the identity credentials of individuals that were created and issued by another federal agency. This trust will only exist if organizations relying on the credentials issued by a given organization have the necessary level of assurance that the reliability of the issuing organization has been established through a formal authorization process.

Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Guidelines for Media Sanitization:

| Executive Summary............................................................................................................................1      |
|-----------------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction...................................................................................................................................2 |
| 2. Background....................................................................................................................................5  |
| 3. Summary of Sanitization Methods..................................................................................................8               |
| 3.1.1. Clear Sanitization Method............................................................................................................8       |
| 3.1.2. Purge Sanitization Method.........................................................................................................10         |
| 3.1.3. Destroy Sanitization Method......................................................................................................11          |
| 3.2.1. Strength of Cryptography for CE ................................................................................................12           |
| 3.2.2. Applicability of CE.......................................................................................................................13 |
| 3.2.3. Sanitization of Keys ....................................................................................................................13  |
| 3.2.4. Quality of Cryptographic Implementations................................................................................15                   |
| 3.2.5.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Security and Privacy Controls for Information Systems and Organizations:

............................................................. 16
3.1   ACCESS CONTROL ..................................................................................................................
18
3.2   AWARENESS AND TRAINING ................................................................................................... 59
3.3   AUDIT AND ACCOUNTABILITY ................................................................................................. 65
3.4   ASSESSMENT, AUTHORIZATION, AND MONITORING ................................................................. 83
3.5   CONFIGURATION MANAGEMENT ........................................................................................... 96
3.6   CONTINGENCY PLANNING .................................................................................................... 115
3.7   IDENTIFICATION AND AUTHENTICATION ............................................................................... 131
3.8   INCIDENT RESPONSE ............................................................................................................ 149
3.9   MAINTENANCE .................................................................................................................... 162
3.10   MEDIA PROTECTION .......................................................................................................... 171
3.11   PHYSICAL AND ENVIRONMENTAL PROTECTION .................................................................... 179
3.12   PLANNING ........................................................................................................................ 194
3.13   PROGRAM MANAGEMENT ................................................................................................. 203
3.14   PERSONNEL SECURITY ........................................................................................................ 222
3.15   PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY .......................

Security and Privacy Controls for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.2 (NIST 3.5.2)?

[Assistant]
According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case:

3.5.2 Installation

1. 3.5.2 Setup Instructions

1. 3.5.2 Disabling of Unsecure services on Network Devices

Use the following guidelines to disable unsecure services on all Allen Bradley devices of the Plant:

1.

Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does User's Guide to Telework and Bring Your Own Device (BYOD) Security provide? (Part 3)

[Assistant]
raft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at http://csrc.nist.gov/publications.
## Comments on this publication may be submitted to:

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

All comments are subject to release under the Freedom of Information Act (FOIA). ## Reports on Computer Systems Technology

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and  Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national securityrelated information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. ## Abstract

Many  people  telework,  and  they  use  a  variety  of  devices,  such  as  desktop  and  laptop  computers, smartphones, and tablets, to read and send email, access websites, review and edit documents, and perform many  other  tasks. Each  telework  device  is  controlled  by  the  organization,  a  third  party  (such  as  the organization's contractors, business partners, and vendors), or the teleworker; the latter is known as bring your own device (BYOD).

User's Guide to Telework and Bring Your Own Device (BYOD) Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Conformance Assessment of Transport Layer Security Implementations:

eeded for event reporting and auditing; and cryptography (i.e., employment of specific cryptographic algorithms) is needed to support Data Integrity, Data Confidentiality, and Authentication services.
These functions are normally collocated in an end-system, with an SP4 entity.

Conformance Assessment of Transport Layer Security Implementations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.5 (NIST 3.3.5)?

[Assistant]
According to Cybersecurity Framework Version 1.1 Manufacturing Profile:

3.3.5. 3.3.5.

Cybersecurity Framework Version 1.1 Manufacturing Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to The NIST Cybersecurity Framework (CSF) 2.0:

urity incident are restored. RECOVER supports the timely restoration of normal operations to reduce the effects of cybersecurity incidents and enable appropriate communication during recovery efforts.
While many cybersecurity risk management activities focus on preventing negative events from occurring, they may also support taking advantage of positive opportunities. Actions to reduce cybersecurity risk might benefit an organization in other ways, like increasing revenue (e.g., first offering excess facility space to a commercial hosting provider for hosting their own and other organizations' data centers, then moving a major financial system from the organization's in-house data center to the hosting provider to reduce cybersecurity risks).